Unauthenticated Access Vulnerability in Spectrum Power by Siemens
CVE-2022-26476

8.8HIGH

Key Information:

Vendor

Siemens
Status
Spectrum Power 4
Spectrum Power 7
Spectrum Power Mgms
Vendor
CVE Published:
14 June 2022

What is CVE-2022-26476?

A significant vulnerability exists in Spectrum Power systems where an unauthenticated attacker can exploit the Shared HIS component by utilizing default credentials. This potential security flaw enables an attacker to gain administrative access to the system, posing serious risks to data integrity and system control. Organizations using affected Spectrum Power versions should prioritize reviewing their deployed systems and update authentication practices to safeguard against unauthorized access.

Affected Version(s)

Spectrum Power 4 All versions using Shared HIS

Spectrum Power 7 All versions using Shared HIS

Spectrum Power MGMS All versions using Shared HIS

References

https://cert-portal.siemens.com/productcert/pdf/ssa-38823...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.